public void doFilter(ServletRequest req, ServletResponse resp, FilterChain chain) {
HttpServletRequest httpRequest=(HttpServletRequest)request;
HttpServletResponse httpResponse=(HttpServletResponse)response;
HttpSession session=httpRequest.getSession();
if(session.getAttribute("username")!=null){
chain.doFilter(request, response); //如果可以放行
} else {
httpResponse.sendRedirect(httpRequest.getContextPath()+"/login.jsp");
}
}
ACL: Access Control List 访问控制列表
RBAC: Role Based Access Control
BAT企业 ACL，一般是对报表系统，阿里的ODPS
总结：不能过于复杂，规则过多，维护性和性能会下降， 更多分类 ABAC、PBAC等
什么是 spring Security：官网基础介绍
Spring Security是一个能够为基于Spring的企业应用系统提供声明式的安全访问控制解决方案的安全框架。它提供了一组可以在Spring应用上下文中配置的Bean，充分利用了Spring IoC，DI（控制反转Inversion of Control ,DI:Dependency Injection 依赖注入）和AOP（面向切面编程）功能，为应用系统提供声明式的安全访问控制功能，减少了为企业系统安全控制编写大量重复代码的工作。
一句话：Spring Security 的前身是 Acegi Security ，是 Spring 项目组中用来提供安全认证服务的框架
什么是 Apache Shiro：官网基础介绍
https://github.com/apache/shiro
Apache Shiro是一个强大且易用的Java安全框架,执行身份验证、授权、密码和会话管理。使用Shiro的易于理解的API,您可以快速、轻松地获得任何应用程序,从最小的移动应用程序到最大的网络和企业应用程序。
一句话：Shiro是一个强大易用的Java安全框架,提供了认证、授权、加密和会话管理等功能
两个优缺点，应该怎么选择
Apache Shiro比Spring Security , 前者使用更简单
Shiro 功能强大、 简单、灵活， 不跟任何的框架或者容器绑定，可以独立运行
Spring Security 对Spring 体系支持比较好，脱离Spring体系则很难开发
SpringSecutiry 支持Oauth鉴权 https://spring.io/projects/spring-security-oauth，Shiro需要自己实现
更多资料导航：http://shiro.apache.org/reference.html
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-web</artifactId>
</dependency>
<dependency>
<groupId>mysql</groupId>
<artifactId>mysql-connector-java</artifactId>
</dependency>
<dependency>
<groupId>org.projectlombok</groupId>
<artifactId>lombok</artifactId>
<scope>provided</scope>
</dependency>
<dependency>
<groupId>com.alibaba</groupId>
<artifactId>druid</artifactId>
</dependency>
<dependency>
<groupId>org.apache.shiro</groupId>
<artifactId>shiro-spring</artifactId>
<version>1.4.1</version>
</dependency>
<!-- mybatis分页支持 -->
<dependency>
<groupId>com.github.pagehelper</groupId>
<artifactId>pagehelper-spring-boot-starter</artifactId>
<version>1.2.12</version>
</dependency>
<!-- tk.mybatis对mybatis做了二次封装-->
<dependency>
<groupId>tk.mybatis</groupId>
<artifactId>mapper</artifactId>
<version>4.1.5</version>
</dependency>
<!-- tk.mybatis与spring boot整合 -->
<dependency>
<groupId>tk.mybatis</groupId>
<artifactId>mapper-spring-boot-starter</artifactId>
<version>2.1.5</version>
</dependency>
权限标准五张表：
public class CustomRealm extends AuthorizingRealm {
/**
* 进行权限校验的时候回调用
*/
@Override
protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals){
SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();
return simpleAuthorizationInfo;
}
/**
* 用户登录的时候会调用
*/
@Override
protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
return new SimpleAuthenticationInfo(username, user.getPassword(),
this.getClass().getName());
}
}
@Configuration
public class ShiroConfig {
@Bean
public ShiroFilterFactoryBean shiroFilter(SecurityManager securityManager){
ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();
shiroFilterFactoryBean.setSecurityManager(securityManager);
shiroFilterFactoryBean.setLoginUrl("/no_login");
shiroFilterFactoryBean.setUnauthorizedUrl("/no_auth");
Map<String, String> chainFilter = new LinkedHashMap<>();
chainFilter.put("/login", "anon"); //允许登录
chainFilter.put("/**", "authc");
shiroFilterFactoryBean.setFilterChainDefinitionMap(chainFilter);
return shiroFilterFactoryBean;
}
/**
* 该类的作用是，实现注解的方式来设置权限
*/
@Bean
public DefaultAdvisorAutoProxyCreator advisorAutoProxyCreator(){
DefaultAdvisorAutoProxyCreator advisor = new DefaultAdvisorAutoProxyCreator();
advisor.setProxyTargetClass(true);
return advisor;
}
/**
* 实现注解的方式来配置权限
*/
@Bean
public AuthorizationAttributeSourceAdvisor
authorizationAttributeSourceAdvisor(SecurityManager securityManager){
AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor = new
AuthorizationAttributeSourceAdvisor();
authorizationAttributeSourceAdvisor.setSecurityManager(securityManager);
return authorizationAttributeSourceAdvisor;
}
/**
@Bean
public LifecycleBeanPostProcessor lifecycleBeanPostProcessor() {
return new LifecycleBeanPostProcessor();
}
*/
/**
* SecurityManager的配置
*/
@Bean
public SecurityManager securityManager(SessionManager manager, Realm realm) {
DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();
securityManager.setSessionManager(sessionManager);
securityManager.setRealm(realm);
return securityManager;
}
/**
* SessionManager的配置
*/
@Bean
public SessionManager sessionManager(){
SessionManager sessionManager = new CustomSessionManager();
return sessionManager;
}
/**
* Realm
* @param addSaltCredentialsMatch
* @return
*/
@Bean
public Realm realm(AddSaltCredentialsMatch addSaltCredentialsMatch) {
CustomRealm realm = new CustomRealm();
realm.setCredentialsMatcher(addSaltCredentialsMatch); //密码规则
return realm;
}
/**
* 自定义的密码加盐规则
* @return
*/
@Bean
public AddSaltCredentialsMatch addSaltCredentialsMatch() {
return new AddSaltCredentialsMatch();
}
}
public class CustomSessionManager extends DefaultWebSessionManager {
/**
* 重写默认的session
* @param request
* @param response
* @return
*/
@Override
protected Serializable getSessionId(ServletRequest request, ServletResponse response) {
String sessionId = WebUtils.toHttp(request).getHeader("token");
if(null != sessionId) {
request.setAttribute(ShiroHttpServletRequest.REFERENCED_SESSION_ID_SOURCE,
ShiroHttpServletRequest.COOKIE_SESSION_ID_SOURCE);
request.setAttribute(ShiroHttpServletRequest.REFERENCED_SESSION_ID, sessionId);
//automatically mark it valid here. If it is invalid, the
//onUnknownSession method below will be invoked and we'll remove the attribute at that time.
request.setAttribute(ShiroHttpServletRequest.REFERENCED_SESSION_ID_IS_VALID, Boolean.TRUE);
return sessionId;
}else {
return super.getSessionId(request, response);
}
}
}
redis作为企业使用最为频繁的中间件，用来缓存各种业务数据，在使用shiro的缓存的时候，课程中还是采用redis来作为缓存中间件。下载地址：https://github.com/MicrosoftArchive/redis/releases
<dependency>
<groupId>org.crazycake</groupId>
<artifactId>shiro-redis</artifactId>
<version>3.2.3</version>
</dependency>
@Bean
public RedisManager redisManager() {
RedisManager redisManager = new RedisManager();
redisManager.setHost("localhost:6379");
return redisManager;
}
@Bean
public CacheManager cacheManager(RedisManager redisManager) {
RedisCacheManager cacheManager = new RedisCacheManager();
cacheManager.setRedisManager(redisManager);
return cacheManager;
}
securityManager.setCacheManager(cacheManager);
@Bean
public RedisSessionDAO redisSessionDAO(RedisManager redisManager) {
RedisSessionDAO redisSessionDAO = new RedisSessionDAO();
redisSessionDAO.setRedisManager(redisManager);
return redisSessionDAO;
}
@Bean
public SessionManager sessionManager(RedisSessionDAO redisSessionDAO){
CustomSessionManager sessionManager = new CustomSessionManager();
sessionManager.setSessionDAO(redisSessionDAO);
return sessionManager;
}
/**
shiro内部提供了做两次md5处理。但是得到数据与其他工具类，得到两次md5数据不一致。
*/
@Bean
public CredentialsMatcher credentialsMatcher() {
HashedCredentialsMatcher hashedCredentialsMatcher = new HashedCredentialsMatcher();
hashedCredentialsMatcher.setHashAlgorithmName("MD5"); //设置加密方式
hashedCredentialsMatcher.setHashIterations(2); //作两次md5加密
return hashedCredentialsMatcher;
}
处理方式：在用户注册的时候，存入密码的时候就按照shiro的规则来储存密码。
new SimpleHash("md5", "123", null, 2).toString() // 将这种处理方式得到的密码存入数据库。